Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Homebrew intelij -ce not flagging vuln #19853

Closed
pacamaster opened this issue Jun 18, 2024 · 4 comments
Closed

Homebrew intelij -ce not flagging vuln #19853

pacamaster opened this issue Jun 18, 2024 · 4 comments
Assignees
Labels
~backend Backend-related issue. bug Something isn't working as documented customer-stazzema #g-endpoint-ops Endpoint ops product group :release Ready to write code. Scheduled in a release. See "Making changes" in handbook. ~released bug This bug was found in a stable release. ~vulnerability-management
Milestone

Comments

@pacamaster
Copy link
Contributor

pacamaster commented Jun 18, 2024

Fleet version:
Fleet 4.50.2
Web browser and operating system:
Current browser and OS


💥  Actual behavior

-ce extensions are not being flagged under homebrew for https://nvd.nist.gov/vuln/detail/CVE-2024-37051
image
image
Same behavior with pycham
image

🧑‍💻  Steps to reproduce

  1. TODO

🕯️ More info (optional)

This does seem to flag as the normal app but are not picked up when searching specific to the homebrew. The .app without -ce looks like is inclusive to the homebrew packages with this CVE.

  • Tried to look for any past issues and found 4.49.3 had some fixes for homebrew, but do not think that included this as a specific case.
@pacamaster pacamaster added bug Something isn't working as documented customer-stazzema :incoming New issue in triage process. ~released bug This bug was found in a stable release. #g-endpoint-ops Endpoint ops product group labels Jun 18, 2024
@JoStableford
Copy link
Contributor

@sharon-fdm sharon-fdm added the :release Ready to write code. Scheduled in a release. See "Making changes" in handbook. label Jun 26, 2024
@sharon-fdm
Copy link
Collaborator

Hey team! Please add your planning poker estimate with Zenhub @getvictor @mostlikelee @lucasmrod

@sharon-fdm sharon-fdm added the ~backend Backend-related issue. label Jul 3, 2024
@sharon-fdm
Copy link
Collaborator

Hey team! Please add your planning poker estimate with Zenhub @jacobshandling @RachelElysia

@lukeheath lukeheath added this to the 4.55.0-tentative milestone Jul 9, 2024
@getvictor getvictor self-assigned this Jul 11, 2024
@sharon-fdm sharon-fdm removed the :incoming New issue in triage process. label Jul 15, 2024
getvictor added a commit that referenced this issue Jul 15, 2024
#19853
Fixing Homebrew intellij/pycharm CE false negative.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
@lukeheath lukeheath modified the milestones: 4.55.0-tentative, 4.54.1 Jul 23, 2024
@xpkoala xpkoala modified the milestones: 4.54.1, 4.55.0-tentative Jul 24, 2024
@fleet-release
Copy link
Contributor

Fleet spots the unseen,
In the cloud city's glow, a
safer code routine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
~backend Backend-related issue. bug Something isn't working as documented customer-stazzema #g-endpoint-ops Endpoint ops product group :release Ready to write code. Scheduled in a release. See "Making changes" in handbook. ~released bug This bug was found in a stable release. ~vulnerability-management
Development

No branches or pull requests

8 participants